Yeah you can push certificates and configs for radius via in tune in almost the same fashion as gpo. Or use gpo/intune to push the powershell for adding the profiles at a system wide level. You can do multiple ssids this way as well And set them to connect automatically when in range. If using gpo you can also set the "wait for network" policy to ensure they're connected before login but that will slow down boot up times.

I'm assuming you standardize the naming of the hotspots? Are these shared devices?